General
-
Target
1e2fab3a423ffc11c1bc916a500c9085_JaffaCakes118
-
Size
1.5MB
-
Sample
240506-y1frrahc6v
-
MD5
1e2fab3a423ffc11c1bc916a500c9085
-
SHA1
46a473fb927d91424c14dddfc2f425e5a3915d39
-
SHA256
a8378d35eb92c8427a1f9505e9b12de0059a3e0463a7a465ae1665301dbf0c7c
-
SHA512
de0067448d6cc9f5faa9073d48c0373e4c67bd08c521f223057cf7fb7ead0aada7a6a273ff92c81c804d2d051c22d29f7ee5ac440e0e5a9c9d75086f66e2bfc5
-
SSDEEP
24576:lAHnh+eWsN3skA4RV1Hom2KXMmHaiz91j7Arls9Z1q8nwh0oRdXDEpF2R88C5:Uh+ZkldoPK8Yaiz9ire/1zxGgpFs8h
Static task
static1
Behavioral task
behavioral1
Sample
1e2fab3a423ffc11c1bc916a500c9085_JaffaCakes118.exe
Resource
win7-20240221-en
Malware Config
Extracted
C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-ntshrui\1\Information.txt
qulab
http://teleg.run/QulabZ
Targets
-
-
Target
1e2fab3a423ffc11c1bc916a500c9085_JaffaCakes118
-
Size
1.5MB
-
MD5
1e2fab3a423ffc11c1bc916a500c9085
-
SHA1
46a473fb927d91424c14dddfc2f425e5a3915d39
-
SHA256
a8378d35eb92c8427a1f9505e9b12de0059a3e0463a7a465ae1665301dbf0c7c
-
SHA512
de0067448d6cc9f5faa9073d48c0373e4c67bd08c521f223057cf7fb7ead0aada7a6a273ff92c81c804d2d051c22d29f7ee5ac440e0e5a9c9d75086f66e2bfc5
-
SSDEEP
24576:lAHnh+eWsN3skA4RV1Hom2KXMmHaiz91j7Arls9Z1q8nwh0oRdXDEpF2R88C5:Uh+ZkldoPK8Yaiz9ire/1zxGgpFs8h
-
ACProtect 1.3x - 1.4x DLL software
Detects file using ACProtect software.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Drops file in System32 directory
-